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INTRODUCTION 


TikTok is the fastest growing social media platform on the internet. 
Quickly encroaching 1 billion active users, TikTok is becoming the social 
media platform of choice in the 15-35 age demographic. From an open 
source intelligence (OSINT) perspective, TikTok is a treasure trove of 
valuable data, including photos, videos, audio, social networks, and 
more. This guide will show you how to discover profiles on TikTok, 
extract content from profiles found, apply analysis to the information 
found, and expand your investigation from TikTok and beyond all within 
the constraints of your web browser. No mobile phones or emulators are 


required. 


Investigative Limitations of TikTok on Desktop 

Similar to Snapchat, TikTok is a mobile-first app; however, unlike 
Snapchat, it does have a desktop version. For the sake of this guide, 
we're going to use the desktop version to discover and extract content. 
You can use a mobile device or emulator, and for certain data points, 
you have to, but it’s much easier to extract content at scale using tools 
available on a desktop. This will make much more sense later on in this 
guide. The TikTok website for desktop has many limitations. This means 
we're going to use various tools and techniques to still get the 


information we're looking for. 
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PROFILE 
DISCOVERY 


This chapter will teach techniques to 
find user profiles using a desktop and 
how to access the information needed 
for an OSINT investigation. 
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ikTok's homepage doesn't have a search 

engine. When you visit the home page, you 

only can see the top-grossing accounts and 
topics or download the mobile app. For most 
investigative purposes, this isn’t helpful. 
Fortunately, Google indexes pages on TikTok, and 
we can use Google Search (or any other search 
engine) to look for specific information on TikTok. 
Let's take a look at a few methods for profile 
discovery. 


site:tiktok.com"ffirst + last name}"OR “{username}” 
Using Google Search, we can use the site: 
operator to filter our results to show only the 
website we specify. In the example above, we 
used site:tiktok.com to only show results from 
TikTok. By replacing {first + last name} with the 
subject in your investigation, you can search the 
entirety of TikTok specifically for the person 
you're looking for. If it's a more common name, 
like John Smith, you'll have to add additional 
identifiers; however, if it's a unique name like 
Jake Creps, you'll find much fewer results that 
are easier to verify. By adding the OR operator, 
you can tell Google to search for two things at 
once without requiring both of them to be 
present on the page. So if you enter 
site:tiktok.com “John Smith” OR “soccerfan247", 
Google will search for mentions of John Smith OR 
soccerfan247 on TikTok. 
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Gogle site:tiktok.com “Terry Crews” OR “terrycrews” x u Q 


QAI Œ News EJ) Images [] Videos < Shopping i More Settings Tools 


About 8,430 results (0.55 seconds) 
Did you mean: site:tiktok.com “Terry Crews” OR “terry crews” 


www.tiktok.com > @terrycrews v 


Terry Crews (@terrycrews) Official TikTok | Watch Terry ... 
Terry Crews (@terrycrews) on TikTok | 39M Likes. 11.3M Fans. PEC POP KING! AGT HOST! 
B99's YOGURT LOVER! 


m.tiktok.com >... v 


Terry Crews(@terrycrews) on TikTok: Rise and shine ... 
Terry Crews(@terrycrews) has created a short video on TikTok with music original sound. Rise 


and shine, @officialhowiemandel! MY FIRST TIK TOK! 


Cb) Videos 


Get Ready!!! For the Side Hustle Premiere on @Nickelodeon ... 
p 
TikTok - Terry Crews 
à Oct 20, 2020 
um WOW! I CAN REALLY DANCE #inmyroom AT AGT... 
TikTok - Terry Crews 
Oct 21, 2019 


Searching for users (a) 


You can enter as many first and last names or usernames as you'd like. Make 
sure to add the OR operator between each identifier; otherwise your results 
will get narrower instead of broader. Here’s an example. 


-site:tiktok.com ”ffirst + last name)” OR “{username}” “tiktok.com” 

Let's say that you tried the first method and nothing came up. That's okay 
and pretty typical. People will often use different display names and 
usernames across different platforms. We're going to have to get more creative 
in these situations to find who or what we're searching for. 
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Using the -site: operator, you're telling Google to 
check every other website except for TikTok. We're 
going to use the same name and username inputs 
here; however, we're going to add ”tiktok.com” at 
the end of the query. What this will do is it will look 
for all other websites where that name or username 
can be found, and it will also check for mentions of 
tiktok.com. This will find users mentioning their 
TikTok profile on Instagram, Twitter, YouTube, or 
any other platform. Notice that there isn't an OR 
operator in between ”fusername]” and 
“tiktok.com.” This is intentional. We're looking for 
any combination of name OR username, but the 
results must include tiktok.com. We don’t have to 
specify the AND operator because it's the default 
operator on Google. Here’s an example (a). 


tiktok.com/@{username} 

The last method for profile discovery is the most 
basic. TikTok uses the same URL structure for every 
profile page. If you have a list of usernames or 
emails and want to check if that username has a 
TikTok profile, simply add the username after 
tiktok.com/@ and see if the profile has information 
matching what you already know. Don't forget to 
add the & in the URL. Without it, you'll get a 404 
page. Here's a correct example. 
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Gøggle 


-site:tiktok.com "terry crews" OR "terrycrews" "tiktok.com" x 


Qall Œ News OC] Videos [Images 9 Maps i More Settings 


About 4,650 results (1.06 seconds) 


twitter.com > terrycrews > status v 


terry crews on Twitter: "| JUST POSTED MY FIRST TIK TOK... 


Oct 18, 2019 — Replying to @terrycrews @howiemandel. If i get a follow here on twitter for a 
lifetime supply of free yoghurt. 0 replies 0 retweets 1 like. Reply. 


twitter.com > terrycrews> status v 


terry crews on Twitter: "Check out Terry Crews's video ... 
Oct 23, 2019 — Replying to @terrycrews. Hi Terry! Tik Tok is censoring videos of the protests in 
Hong Kong because the app's developer (ByteDance) is owned ... 


www.facebook.com > tiktok > photos > terry-crews-and-a... 


TikTok - Terry Crews and Addison Rae are bringing their ... 
Terry Crews and Addison Rae are bringing their fam to yours with #FamilyTime. The live stream 
starts at 5 PM PT and all donations go to Meals on Wheels... 


G @ tiktok.com/@terrycrews 


Tools 


This search contains “tiktok.com” to search for other sites (a) 


Searching usernames directly with tiktok.com/@username (b) 


© x 
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CONTENT 
EXTRACTION 


This chapter will show methods to extract 
the content from profiles for easy analysis 
once data collection is complete. 
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Once a profile that matches the subject in the 
investigation is found, it's time to start 
extracting as much data from that profile as 
possible. Here is where using the desktop 
version of TikTok limits the amount of 
information that is accessible. However, it's a 
great place to start an investigation. If the 
investigation allows and warrants it, it is 
possible to expand to the mobile version of 
the same TikTok profile using a mobile device 
or emulator. This guide will cover that in 
future chapters. First, let's discover what can 
be extracted from the desktop version. 


Profile Pictures 

Unlike Facebook, TikTok only allows users to 
post one profile picture. Unfortunately, this 
means if the user changes their profile 
picture, it's effectively lost. If an internet 
archive of the page doesn't exist, there's no 
other way to recover that image. For this 
reason, it's essential to download that image 
and archive it for evidence collection 
purposes and to establish a timeline 
throughout the investigation in the event the 
picture changes. Previously, downloading 
profile pictures on TikTok was more difficult. 
Now it can be done by simply right-clicking 
the image, opening it in a new tab, and downloading 
it in its full resolution. 
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terrycrews © 


Tarru Crawe 


Open Image in New Tab 


Save Image As... 


‘AE 


Copy Image 

Copy Image Address 
31 Followin: Search Google for Image 9M Likes 
PEC POP Ki IGURT LOVER! 


Inspect 
& Instagram.com/terrycrews 


Right-click to open photo in a new tab (a) 


Open Image in New Tab 


Save Image As... 


| Copy Image 


Copy Image Address 


Search Google for Image 


| Inspect 


We! hee) 


Right-click to save image to storage (b) 
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Now that we've downloaded the profile 

photo, the next step is to copy the username, display 
name, following count, follower count, 

like count, profile description, and social 

media links. Unfortunately, the following, 

follower, and like lists are unavailable on 

desktop. If that list is essential for the 

investigation, using a mobile device or 

emulator will be necessary. When setting up a profile, 
TikTok allows users to link their 

Instagram or YouTube to their TikTok profile 

page. This is a great pivot point and a 

verifiable way to link two accounts together. 

It’s important to know that not all users link 

their profiles, so just because one isn’t listed 

doesn't mean it doesn’t exist. This process 

shouldn't take more than a few seconds. It is 

easiest to either copy and paste the text, take 

a screenshot, or both. 
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terrycrews 9 m 
Terry Crews 


w 


31 Following 11.3M Followers 39M Likes 


PEC POP KING! AGT HOST! B99's YOGURT LOVER! 


& Instagram.com/terrycrews 


Information included in a TikTok profile 
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Videos 

Videos are the bread and butter of TikTok. 
Unlike other platforms, almost all of the 
content on TikTok is user generated. 
Because of this, the subject of the 
investigation is very likely to be in these 
videos. Finding connections, behaviors, and 
locations and establishing a timeline can be 
done by analyzing the videos found on 


TikTok. It is important to download them off of 
TikTok to archive them in the event the user 
takes them offline. Unlike profile pictures, 


it is impossible to right-click on videos to 
download them. First, it is required to isolate 
the video on a separate page to download 
the source video. Here's how to do it. 


Start by clicking on the required video. 
Doing so will open a pop up showing that 
video, the video description, sound file, and 
engagement summary. 


Right-click on the video and choose 
“Inspect.” For this guide, Google Chrome 
was used, but this will work on any browser. 


Next, a panel that has a list of links will show up 


on the page. Find the one that includes 
"v-16-web.tiktok.com” in it. 
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P terrycrews © 
NØ Terry Crews - 11-20 Follow 


Doing the #WalrusDance with Munchy!!! Check out @julesleblanc 


@jaydenbartels and my son @isaiahsamuelcrews on 
@nickelodeon #SIDEHUSTLE 


N original sound - Terry Crews 


@ 2K Ọ 370 share to Q © © O O O 


https://www.tiktok.com/@terrycrews/video/6897267711. @ COPY LINK 


Login to see comments 


Login to see comments and like the video. 


video.jsx-3900254205.horizontal.vi 
525 x 836 
deo-player 
Elements Console Sources Network Performance Memory Application Security Lighthouse 

Styles Computed Layout Event Listeners 


thov .cls 


x-1283372866 <style> 
jsx-1283372866 


It should be directly above the highlighted elements on the page (as 
shown above). Right-click on that link and open it in a new tab. This new 
page will allow the video to be downloaded directly to your local 
storage. TikTok has made a variety of changes to their desktop version this 
year. If an error occurs while trying to access a video, try again later or try a 
different browser. 


Repeat this process for every video on the profile of interest until all videos 
have been downloaded. 
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Video Descriptions 

Each video posted on TikTok has a description. 
Within that description, users often post 
hashtags and other accounts mentioned; 
however, there is also a link to the sound used 
in that video. These are all data points that will 
be valuable for the investigation. Let's start with 


mentions. 


TikTok doesn't hyperlink mentions on the 
desktop version. It is required to copy 
usernames in the description and paste them 
into the TikTok URL structure mentioned before 
to pull up the new profile. Once completed, the 
same content extraction process can be used on 


the new profile as was done on the first. 


The next step is to find hashtags. Hashtags are 
hyperlinked on TikTok for desktop. Once 
clicked, they'll open a new page showing all 
content that used that same hashtag. 
Effectively, this is the unofficial hashtag search 
engine of TikTok. When looking at the URL of 
the page after clicking on a hashtag link, it will 
look like tiktok.com/tag/sanfrancisco. 


THE DEFINITIVE GUIDE: TIKTOK FOR OSINT INVESTIGATIONS 


Searching for any hashtag just requires 
replacing everything after tag/, in this case, 
“sanfrancisco,” with any other topic of choice. 
Using trending hashtags on other social media 
profiles can be useful to find relevant content 
on TikTok. Location names are often 
searchable hashtags because many TikTok 
users will tag the city they live in to get more 
visibility. Here's an example. 


It is important to access and understand the 
date stamp of the video in question. TikTok 
previously allowed users to see the exact date 
and time a TikTok video was uploaded. That 
information is no longer available in the source 
code. Now, only the month and date that a 
video was posted is available. That information 
is located directly to the right of the display 
name, above the video description. 
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Lastly, there's the video's audio. This feature is 
unique to TikTok. They encourage users to take 
audio from someone else's video to use for their 
own video. This was originally intended for songs; 
however, it's used for all types of audio from 
speeches to impersonations to music and 
everything in between. By clicking on the audio link 
in the image, a list of all users that have used the 
same audio in their video is available. For popular 
songs or celebrities, this list could be hundreds of 
other videos. With smaller accounts or regular 
users, this might only be a few videos. Here’s an 
example. 


Through this, it is easy to start creating and 
analyzing social networks or reverse-engineering 
viral content. That leads to the next section on 
applying these discovery steps. 
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© im El x 
= 
ay Terry Crews {11-20 


Doing the with Munchy!!! Check out @julesleblanc 


‘@jaydenbartels and my son @isaiahsamuelcrews on 
@nickelodeon #SIDEHUSTLE 


@ ək & 370 share to O O © O 0O Q 


https:/wwwtiktok.com/a@terrycrews/video/6897267711.. & COPY LINK 


Original sounds can lead to social networks 
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APPLIED 
ANALYSIS 


Now that all available content on a 
TikTok profile has been distracted, it's 
time to perform applied analysis. 
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Profile Picture 
The first thing to mention is that TikTok Check Gmail username availability 


automatically removes the EXIF data of a profile Our free online tool allows you to check your username for availability in GMail. It 


image, so there is no additional data from the will instantly check if the login is free. A quick and easy way to find a suitable 


picture by analyzing the metadata. The next email address for your purposes. To check picked nickname, you must insert it 


step ‘ato eoncuicts reverse image search. The into the line below your own version. It must be at least 6 characters, and you will 


immediately see the result. 


best practice for this is to use Google, Bing, and 
Yandex. Google might be the best for search 
but can fall short on reverse image search. This @gmail.com 
will give you reverse image results if the subject 
is using the same image on other profiles. 
Doing so will also help get a better idea of how 


old the picture is or any additional information 


. . H . . ? 
other platforms may afer By doing this, wecan How to choose the best nickname for a new account in GMail 


identify other personal accounts, alias accounts Source etecksmailealebicom 
and establish a more clear timeline for the 


investigation. Here’s an example. 


Biographical Information Many social media platforms will use the same username as the user's email 
The most valuable identifier on TikTok, when it address, if available, by default, but some users will change this to match 
comes to reverse searching, is the username. their other profiles. Both of these scenarios are helpful for investigators. 
People often use the same username across Reverse searching the username from TikTok will generally help find 

multiple profiles. This tends to be true not only additional social media profiles. Alternatively, suppose the TikTok profile has 
for influencers or influencers to-be but also for a username that doesn’t match the username of social media profiles that 
regular accounts. belong to the same subject. In that case, an email verifier tool can be used to 


see if that username matches a common email provider such as Gmail, 


Outlook, Yahoo, Protonmail, etc. 
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Because TikTok allows users to connect their 
Instagram and YouTube profiles to their 
TikTok page, an investigation can quickly 
expand to those resources to find additional 
content. Likewise, as mentioned above, 

identifying if the TikTok username matches 


an Instagram profile or YouTube channel can be 


done manually. This guide will cover how to 
expand an investigation beyond TikTok 
and cover techniques and tactics to get the 
most out of that process. 


Many people online also use the same 
profile description for all of their social media 
accounts. If not the exact description, they 
copy elements of that description. Searching 
for the exact description on Google using 
the quotes operator can help to find other 
profiles from the same user. However, it is 
also helpful to break the description apart, 
sentence by sentence, and search for that 
individually. Here's an example. 


Videos 

Videos on TikTok are likely to be where the 
most valuable information is found when 
analyzed. TikTok already gives the date that 
videos are published. 
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Having these dates is the first step in building 
an entire timeline when the subject is active 
online. Beyond just a basic timeline, it can 
help piece together where the individual was 
around the time the video was posted. 


If the subject's address is known, verifying if 
the video was shot at home can be done by 
analyzing the property. By checking for major 
landmarks, it can be determined where the 
subject shot the video as well. TikTok videos 
sometimes include multiple individuals. If the 
main subject cannot be identified, it's 
identify 
connections and find the main subject 


possible to associates and 


through them. 


Because the date only reflects when the user 
posted the video to TikTok, there could be a 
gap between production and publication. 
Many users will use the TikTok app to record 
their videos; however, they can record them 
in advance and publish the video later. Keep 
this in mind before confirming a timeline. 
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Video Descriptions 

Video descriptions on TikTok are composed of 
three main elements, as described before. 
Hashtags, tagged users, and audio. Some 
hashtags are global and viral; however, some 
are local and more individualized. Look for the 
local and individualized ones. This will give 
clues as to where the individual might live, what 
events they've attended, or who might be in 
their immediate or adjacent social network. 
Tagged users are a bit more straightforward. 
Suppose the main subject is being More 
elusive. In that case, using individuals tagged in 
their TikTok videos to expand the investigation, 
potentially finding more information about the 
main subject and their social network. 
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Lastly, audio can show who is intimately 
engaging with someone's video. Using audio 
from another video is more than just a like or a 
comment; it is someone taking their video 
and creating original content from it. TikTok 
allows users to add original sounds, like a 
speech or a joke; however, they also let users 
add popular music or anyone else's audio. 
These can be found as audio clips labeled as 
“original sound.” If someone else uses the 
original sound for a non-celebrity, more 
localized account, the likelihood that person is 
in their social network is much higher. 
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EXPANDING 
THE SCOPE 


Next, learn what other social media networks 
can be easily searched from the information 
gathered from TikTok and how to create a more 
complete timeline of your subject's social life. 
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Once a subject's profile is identified on TikTok, 
all of the content has been extracted, and the 
analysis process has begun, it's important to 
recognize that the investigation isn't over and 
there might be other 

information potentially available. Remember 
that you can tag other users in videos on TikTok, 
but it is also possible to search for videos that 
the subject was mentioned in. This is a bit 
trickier but can be done. By 

searching Google's index for mentions of the 
username, {@username}, within the text of the 
page while simultaneously filtering out the 
subject’s TikTok profile, the exact results can be 
found. Here's how it’s done. 


site:tiktok.com -site:tiktok.com/@{username} - 
intitle:"{display name}” intext:"@{username}” 


Using this search technique is a bit more 
complicated, so let's break it down. The 
site:tiktok.com command tells Google to only 
show TikTok in the search results. 
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Gøggle site:tiktok.com -site:tiktok.com/@terrycrews -intitle:" Terry Crews" intext:"@te > 4 Q 
Q All @ News © Shopping © Images [J Videos i More Settings 
All 1h 1d 7d 1m 6m 1y 2y ~ 7.2k Verbatim 


www.tiktok.com > video 


@terrycrews @sarati @amandacerny @ashleynocera - TikTok 


6215. @kingbach - @terrycrews @sarati @amandacerny @ashleynocera - 
Seve - Tez Cadey. Seve ... 
Feb 12, 2020 - Uploaded by KingBach 


You visited this page on 12/10/20. 


m.tiktok.com>... v 


jenkinsharria(@jenkinsharria) on TikTok: Tag @terrycrews ... 
Tag @terrycrews #greenscreen #fyp #viral #muscle #pose #nbamoments #cleaningszn 
#terrycrews #funny #duet. Crew. Create your own videos! Download ... 


Extracted username list (a) 


The -site:tiktok.com/@{username} (replacing {username} with your subject's 
username) command tells Google to remove all results that come from the 
subject's profile. The -intitle:"{display name}” is added to remove links that 
list the TikTok user's display name in the web page title. Lastly, the 

intext: ”@{username}” tells Google to look for a username match within the 
text of the page, specifically in the video description. Here’s an example. 


This technique is about 90% effective. There may be cases where the 
subject's profile still appears because of the variety of URL structures TikTok 
uses for mobile and tablet viewing. It is possible to filter these out also, but 
the 90% solution is acceptable for most investigations. 
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BRUADENING THE 
INVESTIGATION 


This chapter is about going beyond social 
media and going one level deeper into 
your investigation through automation 


19 THE DEFINITIVE GUIDE: TIKTOK FOR OSINT INVESTIGATIONS SKOPENOW 


Thus far, this guide has shown best practices 
for identifying, extracting, analyzing profiles 
and how to expand the scope of an 
investigation to factor in other user's 
mentioning a subject. This final chapter is how 
to broaden an investigation beyond TikTok. 
While TikTok allows users to connect an 
Instagram or YouTube channel to their TikTok 
profile, many users don't use this feature. Yet, 
because TikTok assumes the user might, we 
should too. If they don't, an alternative method 
is needed for finding other accounts. Using this 
query can verify that assumption. 


site:youtube.com OR site:instagram.com 
"{username}” OR ”ffirst + last name)” “tiktok” 
OR “tik tok” OR “tiktok.com/@{username}” 


This will be the largest Google query covered in 
this guide, so it'll be step by step. The 
site:youtube.com OR site:instagram.com tells 
Google only to show results for YouTube or 


Instagram. 
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Güğgle sieys com OR sieinstagrim.cam “lemycrews” A ‘ery crews" ii 3x! i: a 


Terry Crews Tik Toke 2020 - YouTube 


Termer S Tik Tos mirei 
F TeC rA SUL Le Dy E k FI Yi 


WEA pou Gi wt 


Terry Crews first TIKTOK Witeo! #riseandshine … - YouTube 
i - his ia ġe ni TETOR viis af Terry Greas. Folhas him on Tiigi 8 
IEF, lerede sirene re pleat 
' fT), 019 - Undeaded by TIK To Garmunined 


Extracted username list (a) 


The “{username}” OR ”ffirst + last name)” command looks for the name or 
username of the subject. The ”tiktok” OR “tik tok” OR “tiktok.com/@{username}” 
command tells Google to look for mentions of the word tiktok, tik tok (spelling 
variation) or the exact URL of the subject. These three commands are chained 
together by an understood AND operator, so we don’t have to specify it. Here's 


an example. 
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This query will only yield results that include 
content from YouTube or Instagram that 
match the subject's specific identifiers (name 
and username). It is important to explore this 
content, looking for deleted videos, 
username changes, comments, likes, and 
other evidence that can be used in the 
investigation. After verifying Instagram and 
YouTube, expand to LinkedIn, Twitter, 
Facebook, and other available profiles. 
Building a holistic social network for a 
subject requires information that might not 
be found on a more public profile like 
TikTok. Expand timelines to include content 
before (and sometimes after) the most 
recent TikTok video. Discover new locations 
the subject has been, groups they're a part 
of, or topics they've discussed. Create a 
robust investigation that produces 
actionable intelligence. 


Using a tool like Skopenow can automate 
each process outlined in this guide. 
Skopenow will automatically conduct reverse 
username searches across all social media 
platforms and expand the search using 
publicly available information from 1000's of 
sources. Skopenow will automate the 
collection, archive the followers and follow 
lists for further investigation. Lastly, 
Skopenow’s automatic report builder will 
save time organizing the hundreds of data 
points collected in a clean and organized 


manner. 


Contact us for a demo to see how Skopenow 


can streamline your OSINT workflow. 
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